
        <html>
			<head>
			     <title>使用OpenSSH证书认证 - r00tgrok</title>
				 <meta http-equiv="content-type" content="text/html; charset=UTF-8">
			</head>
			<body>
				<h1>原文地址:<a href="http://drops.wooyun.org/tips/1055">http://drops.wooyun.org/tips/1055</a></h1>
				
      <p>
        <h2>0x00 摘要</h2>

<hr />

<p>2010年三月，ssh证书认证悄然地包含到了OpenSSH5.4中。到了2014年，很多人对ssh证书依旧相当模糊，既没有得到广泛的理解，也没有得到广泛的使用。对于这样一个问题，我们可能会认为它实施起来要不是很难，就是很复杂。实际上这样做既不难，也不复杂，只是它没有得到较好的文档化的描述。 </p>

<p>本文的目标是以一种实际的方式向各位展示使用和管理ssh证书认证有多容易，无论是较小的还是较大的环境。</p>

<p>本文的创建用于解答笔者日常中遇到的一些ssh证书认证的问题，当然还增添了在学习过程中发现的一些东西。本文内容中也许会有点小差错，某些特性也没有提到，欢迎各位指正。</p>

<!--more-->

<h2>0x01 基本知识</h2>

<hr />

<p>本文假设你已经了解：</p>

<pre><code>基本的Unix/Linux服务器管理
</code></pre>

<p>SSH管理，包括但不限于：</p>

<pre><code>a) 密钥生成
b) SSH公钥认证
c) 使用SSH代理
d) 使用口令加密密钥
</code></pre>

<p>基本的安全概念如：</p>

<pre><code>不要直接以root身份登陆
</code></pre>

<h2>0x02 SSH证书介绍</h2>

<hr />

<p>证书是已有的ssh公钥认证系统的扩展，可被应用于任何已有的公钥和私钥对，也可以用于任何当前ssh支持的认证方法。</p>

<p>尽管(SSH证书认证)基于公钥认证，它同时也被设计来简化多台服务器之间密钥管理的复杂性。证书免除了对已知主机和经授权用户文件的需要，如果实现合理的话，只许更少的人力便能复制全部功能。</p>

<p>由于证书认证是公钥加密的一个扩展，它可以与OPenSSH支持的任意密钥类型和密钥大小的ssh2协同使用。这意味着如果你当前的OpenSSH支持的话，RSA、DSA、EC都能使用。方便起见，本文将使用默认的RSA-1024。</p>

<p>Tips:有些较老的操作系统虽然使用OpenSSH5.4或更高的版本，但是还是不支持EC。</p>

<h2>0x03 证书 VS. 公钥</h2>

<hr />

<p>常规的公钥认证和证书认证之间有几点较大的不同，最大的不同就是证书验证上。</p>

<h3>与其他公钥证书标准不同</h3>

<p>SSH证书相比其他证书格式如x509、SSL中使用的PEM更为简单</p>

<pre><code>a) 没有证书链，只有一个CA
b) 没有可疑的的商业签名授权(authority)
c) 除了CA签名外没有可信模式
</code></pre>

<h3>主机认证</h3>

<table>
<thead>
<tr>
  <th align="center">操作</th>
  <th align="center">公钥认证</th>
  <th align="center">证书认证</th>
</tr>
</thead>
<tbody>
<tr>
  <td align="center">认证未知主机</td>
  <td align="center">初始登陆时询问用户是否接受主机秘钥</td>
  <td align="center">验证CA签发的主机证书</td>
</tr>
<tr>
  <td align="center">认证已知主机</td>
  <td align="center">将密钥和用户的已知主机文件对比</td>
  <td align="center">验证CA签发的主机证书</td>
</tr>
<tr>
  <td align="center">替换已知主机的密钥</td>
  <td align="center">a) 入口必须从用户的已知主机文件中删除 b) 用户登录时会被问及是否接受新的主机秘钥</td>
  <td align="center">验证CA签发的主机证书</td>
</tr>
<tr>
  <td align="center">撤销密钥/证书</td>
  <td align="center"><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="bd5821155a29155b350a5a2739d6d3d2cad3e2d5d2cec9ce5b2b3a59060b590510581f2358371d5f3d21fdcfd8cbd2d6d8d95f3d20551c31">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script></td>
  <td align="center"><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="d530497d32417d335d62324f51bebbbaa2bb8abdbaa6a1a6334352316e63316d7830774b305f7537554995a7b0a3babeb0b13755483d7459">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script></td>
</tr>
</tbody>
</table>

<h3>使用证书认证的好处</h3>

<pre><code>a) 用户可以认证之前没有登入过的主机
b) 无需再分发或管理已知的已知主机文件(例：puppet)
c) 可以无需用户干预实现服务器替换及密钥再生成
d) 除非什么地方出错了，用户在工作场合再也不会收到接受服务器密钥的提示
e) 通过搜索未签名的主机密钥可以发现不一致的主机
</code></pre>

<h3>用户认证</h3>

<table>
<thead>
<tr>
  <th align="center">操作</th>
  <th align="center">公钥认证</th>
  <th align="center">证书认证</th>
</tr>
</thead>
<tbody>
<tr>
  <td align="center">认证</td>
  <td align="center">用户的公钥来自每个服务器主机用户经授权的密钥文件</td>
  <td align="center">检查用户证书是否由CA签名</td>
</tr>
<tr>
  <td align="center">过期密钥/证书</td>
  <td align="center">不做强制</td>
  <td align="center">过期时间由管理员在签名时设置</td>
</tr>
<tr>
  <td align="center">登录用户名</td>
  <td align="center">服务器上的目标用户的公钥置于每个用户目录下的authorized_keys文件中</td>
  <td align="center">用户名可在签名时添加到证书中，也可由每个服务器上的AuthorizedPrinciples文件控制</td>
</tr>
<tr>
  <td align="center">限制(端口转发、强制命令等)</td>
  <td align="center">可以在authorized&#95;keys文件中(可被用户编辑)，可在每个服务器sshd&#95;config的匹配用户/组块中</td>
  <td align="center">可在签名时加入证书中，可在每个服务器sshd_config的匹配用户/组块中，可在每个服务器”经授权的规则”中添加</td>
</tr>
<tr>
  <td align="center">撤销密钥/证书</td>
  <td align="center">可添加到每个服务器的RevokedKeys文件中或从服务器上每个受影响的authorized_keys文件移除</td>
  <td align="center">每个服务器上将证书添加到”RevokedKeys”文件中</td>
</tr>
<tr>
  <td align="center">替换用户的证书</td>
  <td align="center">服务器上authorized_keys文件必须可被编辑</td>
  <td align="center">将旧证书添加到服务器上已撤销的密钥文件或签名新的证书</td>
</tr>
</tbody>
</table>

<p>使用证书认证的好处</p>

<pre><code>a) 证书过期时间可由管理员在签名时设置，强制实施轮转策略 
b) 无需跨越多台主机管理已授权的证书 
c) 不用担心恶意用户编辑或添加内容到未管理的经授权文件 
d) 在签名时更容易限制某些用户的权限 
e) 无需从已授权密钥文件中移除已吊销的密钥 
f) 证书签名时可以限制用户使用指定的用户名 
</code></pre>

<h2>0x04 让它工作起来</h2>

<hr />

<p>实现ssh证书认证要比SSL证书容易得多，最难的地方是决定签名用户和服务器是使用单个CA密钥还是使用两个CA密钥——服务器和用户各一个</p>

<p>我们推荐使用两个独立的密钥用于签名的用户和服务器，以便让不同的角色来管理每一个功能：例如，一个系统管理员可以登录服务器密钥，而安全管理员可以登录该用户的密钥。</p>

<p>下面的例子中服务器和用户使用各自的证书授权</p>

<h3>服务器授权</h3>

<p>激活服务器授权仅需4个步骤</p>

<h4>1. 创建服务器CA</h4>

<p>在你的证书授权服务器上运行下列命令：</p>

<pre><code>#!bash
~ $ # Lets start with good organization
~ $ mkdir -p ssh_cert_authorita/server_ca
~ $ cd ysh_cert_authority/server_ca/

~/ssh_cert_authority/server_ca $ # Now lets generate our server certificate authority keypair
~/ssh_cert_authority/server_ca $ ssh-keygen -f server_ca -C "companyname_server_ca"
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
wour identification has been saved in server_ca.
Your public key has been saved in server_ca.pub.
The key fingerprint is:
21:f6:9f:5d:ec:75:2e:df:c0:6b:5e:9d:5b:97:d8:19 "companyname_server_ca"

~/ssh_cert_authority/server_ca $ # The resulting files
~/ssh_cert_authority/server_ca $ ls -l
total 8
-rw------- 1 username username 1675 Aug 16 14:12 server_ca
-rw-r--r-- 1 username username  409 Aug 16 14:12 server_ca.pub
</code></pre>

<p>Tips:强烈建议不仅使用密码，还要使用强密码。任何用这个密钥签名的人都能添加受信任的服务器访问到你的网络。</p>

<h4>2. 签名主机密钥</h4>

<p>既然证书认证是公钥认证的一个扩展，你可以使用已有的</p>

<pre><code>/etc/ssh/ssh_host*key.pub
</code></pre>

<p>ssh主机密钥。举例来说，任何类型的ssh主机密钥都可以。</p>

<p>在你的证书授权服务器上运行如下命令：</p>

<pre><code>#!bash
~/ssh_cert_authority/server_ca $ # 为拷贝主机密钥和证书留个地方
~/ssh_cert_authority/server_ca $ mkdir -p host_certs
~/ssh_cert_authority/server_ca $ cd host_certs

~/ssh_cert_authority/server_ca/host_certs $ # 从主机下载主机密钥
~/ssh_cert_authority/server_ca/host_certs $ scp -rp example.host.net:/etc/ssh/ssh_host_rsa_key.pub example.host.net.pub
ssh_host_rsa_key.pub                                                                   100%  396     0.4KB/s   00:00    

~/ssh_cert_authority/server_ca/host_certs $ # 签名主机密钥
~/ssh_cert_authority/server_ca/host_certs $ ssh-keygen -s ../server_ca -I example.host.net -h -n example.host.net,96.126.102.173,2600:3c01::f03c:91ff:fe69:87a2 example.host.net.pub 
Signed host key example.host.net-cert.pub: id "example.host.net" serial 0 for example.host.net,123.45.67.89,2600:dead:beef:cafe:::87a2 valid forever

~/ssh_cert_authority/server_ca/host_certs $ # 结果文件
~/ssh_cert_authority/server_ca/host_certs $ ls -l
total 8
-rw-r--r-- 1 username username 1430 Aug 16 14:19 example.host.net-cert.pub
-rw-r--r-- 1 username username  396 Jul 14 20:19 example.host.net.pub

~/ssh_cert_authority/server_ca/host_certs $ # 将证书考回服务器
~/ssh_cert_authority/server_ca/host_certs $ scp -rp example.host.net-cert.pub <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="067469697246637e676b766a63286e69757228686372">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:/etc/ssh/ssh_host_rsa_key-cert.pub
example.host.net-cert.pub                                                           100% 1430     1.4KB/s   00:00
</code></pre>

<p>Tips：</p>

<pre><code>保留CA的所有公钥及证书，如果你需要撤销它们，最好复制一份 

创建服务器证书时，注意 –l 、–h、 –n 选项的用法 

1) -n 选项只能指向相关的主机名、IP地址，空格、通配符或任意名字会导致可互换的服务器证书 
2) -l 选项可以是用于标识这个证书的任意文本，而且你没必要使用和上面同样的格式 
3) -h 选项标明证书为主机证书
</code></pre>

<h4>3. 改变服务器配置</h4>

<pre><code>HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
</code></pre>

<p>保存/etc/ssh/sshd_config保存完毕后，重启sshd</p>

<h4>4. 客户端配置改变</h4>

<p>复制<code>server_ca.pub</code>中的文本，进入你的<code>~/.ssh/known_hosts</code>(或<code>/etc/ssh/known_hosts</code>)文件，参考：</p>

<pre><code>#!bash
@cert-authority *.host.net,123.45.67.* ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVifNRc+EN4b9g/ygWRCIvV1qw0aR33qzkutIA6C3MzHidaXe6tO4Q35YqrP2UUhOdcl2g8nO7BNSSHkjrFyEnyNqkpgHYcDzUdpE6XGS6rNcjrmLajf1CRvUBvFD0ceu//z6HL1dpE347AHSZbFxHT6NdhscdEd/Bd5c1aVyS+dUdiGX4U9YdgTN2lM8zQy5rJo+siFyHmtqXh1ZVBBC+VBF6ZPzMkxvkJmAp4eWCQJOZLIybcNZlyuXrs1bXV0X0ZIIL2j/gYC2gJPO1FUTKRcqzo/fQ/m6hAhxMMpTTgI92FiE/QOfOk5+MmgfTOqsF0us2TJ5mrSIE9o/3DQsj "companyname_server_ca"
</code></pre>

<p>Tips：</p>

<pre><code>a) 删除 known_host 中与”example.host.net”相关的host
b) 该文件的格式遵循标准的known_hosts格式，但要注意通配符匹配整个域和IP地址范围。
</code></pre>

<h4>5. 测试服务器认证</h4>

<pre><code>#!bash
~ $ ssh -v <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="3f4a4c5a4d515e525a7f5a475e524f535a1157504c4b11515a4b">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
...
debug1: Server host key: RSA-CERT 39:aa:3f:bb:eb:24:11:93:15:b1:63:2f:de:ad:be:ef
debug1: Host 'example.host.net' is known and matches the RSA-CERT host certificate.
...
</code></pre>

<h3>用户认证</h3>

<p>用户认证不会比服务器认证更难</p>

<h4>1. 创建用户CA</h4>

<p>在你的证书授权服务器上运行下列命令：</p>

<pre><code>#!bash
~ $ # Lets start with good organization
~ $ mkdir -p ssh_cert_authority/user_ca
~ $ cd ssh_cert_authority/user_ca

~/ssh_cert_authority/user_ca $ # 生成我们的服务器证书授权密钥对
~/ssh_cert_authority/user_ca $ ssh-keygen -f user_ca -C "companyname_user_ca"
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in user_ca.
Your public key has been saved in user_ca.pub.
The key fingerprint is:
90:67:8a:ed:b6:53:0a:bd:06:f0:71:ce:fb:89:b9:3e "companyname_user_ca"

~/ssh_cert_authority/user_ca $ # 结果文件
~/ssh_cert_authority/user_ca $ ls -l
total 8
-rw------- 1 username username 1679 Aug 16 18:14 user_ca
-rw-r--r-- 1 username username  407 Aug 16 18:14 user_ca.pub

~/ssh_cert_authority/user_ca $ # 把user_ca.pub复制到服务器上
~/ssh_cert_authority/user_ca $ scp -rp user_ca.pub <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="fd8f929289bd98859c908d9198d395928e89d3939889">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:/etc/ssh
user_ca.pub                                                                            100%  407     0.4KB/s   00:00
</code></pre>

<p>Tips:强烈建议不仅使用密码，还要使用强密码。任何用这个密钥签名的人都能访问你网络中所有服务器上的任意用户。</p>

<h4>2. 签名用户密钥</h4>

<p>让一个用户创建一个ssh公钥集，并获得他们公钥的拷贝</p>

<p>恢复用户公共SSH密钥的拷贝，执行如下命令：</p>

<pre><code>#!bash
~/ssh_cert_authority/user_ca $ # 我们需要一个地方存放签名的证书
~/ssh_cert_authority/user_ca $ mkdir -p user_certs
~/ssh_cert_authority/user_ca $ cd user_certs/

~/ssh_cert_authority/user_ca/user_certs $ # 以使用公钥为例
~/ssh_cert_authority/user_ca/user_certs $ cp ~/.ssh/id_rsa.pub username.pub

~/ssh_cert_authority/user_ca/user_certs $ # Sign the key
~/ssh_cert_authority/user_ca/user_certs $ ssh-keygen -s ../user_ca -I user_full_name -n root,loginname username.pub 
Signed user key username-cert.pub: id "user_full_name" serial 0 for root,loginname valid forever

~/ssh_cert_authority/user_ca/user_certs $ # 结果文件
~/ssh_cert_authority/user_ca/user_certs $ ls -l
total 8
-rw-r--r-- 1 username username 1525 Aug 16 22:01 username-cert.pub
-rw------- 1 username username  411 Aug 16 22:00 username.pub

~/ssh_cert_authority/user_ca/user_certs $ # 复制证书到用户的~/.ssh/文件夹下
~/ssh_cert_authority/user_ca/user_certs $ cp username-cert.pub ~/.ssh/id_rsa-cert.pub
</code></pre>

<p>Tips：</p>

<pre><code>保留CA的所有公钥和证书，如果你需要撤销它们，最好复制一份 
当创建服务器证书时，你不能否认–l、–n 选项的使用 

a) -n 选项只能指向相关的登陆用户名，空格、通配符名字会允许任何有效用户账户的登录，除非在服务端有其他的严格限制。在本例中，用户名使用root和loginname
b) -l 选项可以是用于标识这个证书任意文本，而且你没必要使用和上面一样的格式
</code></pre>

<h4>3. 服务器配置改变</h4>

<p>在你想激活证书认证的每台服务器上将如下代码添加至<code>/etc/ssh/sshd_config</code></p>

<pre><code>TrustedUserCAKeys /etc/ssh/user_ca.pub
</code></pre>

<p>保存sshd_config文件，重启sshd</p>

<h4>4. 测试用户认证</h4>

<p>从服务上所有的经授权密钥文件中删除用户公钥</p>

<p>运行如下命令：</p>

<pre><code>#!bash
~ $ ssh -v <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="a2d7d1c7d0ccc3cfc7e2c7dac3cfd2cec78ccacdd1d68cccc7d6">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
...
debug1: identity file /home/username/.ssh/id_rsa-cert type 4
debug1: Offering RSA-CERT public key: /home/username/.ssh/id_rsa
debug1: Server accepts key: pkalg <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="88fbfbe0a5fafbe9a5ebedfafca5feb8b9c8e7f8ede6fbfbe0a6ebe7e5">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script> blen 1101
...
</code></pre>

<p>另外，如果你开启了调试记录，你会看到如下日志：</p>

<pre><code>#!bash
Jul 18 23:22:03 localhost sshd[9603]: debug1: list_hostkey_types: ssh-rsa,<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="2251514a0f5051430f414750560f541213624d52474c51514a0c414d4f">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script> [preauth]
Jul 18 23:22:03 localhost sshd[9603]: Accepted certificate ID "user_username" signed by RSA CA d2:c0:6c:08:2b:e4:b4:f2:cd:56:22:66:de:ad:be:ef via /etc/ssh/user_ca.pub
</code></pre>

<h2>0x05 更进一步</h2>

<hr />

<p>上述步骤是证书认证的基础，接下来我们会涵盖一些更细节的特性。</p>

<h3>撤销密钥和证书</h3>

<p>授予访问你的服务器很棒，但是你必须要有权利撤销这种访问</p>

<p>下面的方法同样适用于公钥认证，目前它们是撤销ssh证书的唯一方式</p>

<h4>1. 撤销用户密钥</h4>

<p>启用用户取消功能，将如下代码添加至你服务器的<code>/etc/ssh/sshd_config</code>：</p>

<pre><code>#!bash
RevokedKeys /etc/ssh/ssh_revoked_keys
</code></pre>

<p>然后输入如下命令：</p>

<pre><code>#!bash
~ $ # 如果文件不存在且对sshd不可读，**all** 用户将没有访问权限
~ $ sudo touch /etc/ssh/ssh_revoked_keys
~ $ sudo chmod 644 /etc/ssh/ssh_revoked_keys.
</code></pre>

<p>一旦完成，重启sshd</p>

<p>当需要从服务器撤销用户访问权限时，简单地添加其公钥或证书到<code>/etc/ssh/ssh_revoked_keys</code>中。文件格式同authorized_keys密钥类似，一个密钥或证书占一行</p>

<pre><code>#!bash
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL8HShSFKdY3Tox9U+gUotTFlRedPxI5zSrU6KiZEXA8i+37BtB0yp502q3Dx1MmXBF8Pqa+xEQ9DOgtragDwX0V7ieOjvRSB83w2Orj9cdMj8U6WluU2T+QlD2JtVmOp0Skg4k3AENIN9J0rmnxvmuCZa2G5f+6DGp/pW5kk9FfNv1xaAOgy3yfExD2w5cEHZfztajbTuCE6z9aNxU96ZHvXdV6Z8M3xkkea6IUU3XCyg+lB/qSq+KoBoByzwZSJ6BfA7x63okq57K6XsPp4GuVukq0OmDk9ZLpqmeC8esWhniA+2DwmjdaFa1k9K/bpCy4mVLhqTgwkU9u8rxaCd <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="61141204130f000c0421090e12150f000c04">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="4437372c69363725692721363069327475042b34212a37372c6a272b29">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script> <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="f8b9b9b9b9b0b0b68299bbc9819bcabd8ca1caae819cbbc9cab5bcbeb99acbba949a96b68299bbcd929acac8b9b9b9b99f9b8ab0ac99cbbfbc96cdc9bf96b996bf8d">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="582d1e2277772c0b73162b1133682808696e361d3f34306c776860191919191c1909191a1919191a19091b20346f0a0b33022f0a0f68313f22130d1f0d29332c301e">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="8bfdc3b3d8feb8e6bbccbae0dcc8bfd2c9dae3ffb2dfe0d3f8d8f8dcdddcbecdcce9c2ccf9d2dcf2b9c1c4c1e5eccac0dfe0bddfb3b9f2d8e2fec1e5c6cab9eef8ce">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="550261213d0f603e256d1832311636182024001233130d2d3e1d1d1365363b2f0c6514020611662f6d022320120310021101211c002517243c027a0f23030f320325">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="aae2fcc3dbedec92ebebc8c3ece698c3f8ceed9eee9fcd999fd3ceecd99aeddfc0c49992d0ccd3e0e6f8fce185ebfbdedbf993d3d0c29cddf8cccde5df9a85fbf2e3">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="8ba4fbd2ddddbfe2e6fed3ecdac8f8e4fedca4ecd8c2fffdecbedaeffbb3fff2eacabbe3d2c1cabcd3c3cfbdcfc8f3f9b8d9fbe7dfbad3f9f8c2c6fed9c4d2bae5d8">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="0b7a5f7a3b7c7b53673c535b463d6a47447f783d387e5b727b7e6646427e7a3e607a53203e45496f20483d6c4f654e5e3c536e6f686e20486324474a4a4a4a4a4a4a">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="2e6f6f6f6f6f6f6f6f6c6f6f6f6f6a407854747664487440785d4c68175b77791f426f6f6f6f6a6f6f6f6f6f461f4d1c78574c43685a747f6f6f6f6f6f6f6f6f6f6f">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="a08f8f8f8f8f8f8f8f8f8f98e1e1e1e1e1e1e1e1e1c7c7e1e1e1e2f6d7faf8ead4c1f8f1d4f7e4e5d8ecf7fad6c3cec4c8c3cdf2d0c2cdc3e1e1e1e1e1e1e1e1e1e6">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="390a7b555a5408495d7a0851630b6f4c5d7a08545b0a730a60617352586e0c577878787878787878787b634e6361734d5861684d5a7e00405d7a08545b0a730a6061">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="95dffef4c2a0fbd4d4d4d4d4d4d4d4d4d4e5e2cfcddfe1f4cdc4e1f6ddc7a0d4d4d4d4d4d4d4d4d4d4a0e2cfcddfe1f4cdc4e1f1cddbf9f6fca4eccce2d4d4d4d4d4">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="da9b9b9b9b9b9b9b9b989cad9b9b9b9bbea0b9e8bdaeb9b494b29b9b9b9b9bad9f9b9b8b9b9b9b8b9f9ba3f598eab58fb289b48d94eaec97bc8c8ab59c91968fa280">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="bfeae7d1eb87ecf0dc8fce8ef0d6d0d2edf9c8eff6c9cb94c8ddeedbf2cedadbf1cecbc887dbebf5d3c8edd9fb89d2c9ccedfaefeec5d0f3de8dd0fe87f986f9da8b">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="87e9ede8b0b7d2e0e1c9bfc9edf6b3a8dfcfd3cea8c1c8ebf7e5ebc9eca8eccdd6beeee5d1ddedf6e3c2f7cec8cdc9f0c5c3d4c3e1d4e3ccb2f7bfe5b2f5e0ead0f3">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="7e160b26510b19060f1848280b24342e2c26041c471d29193a11330a461006332f470d31263c3c4c26464929114c4e491916310d5129141d282e1b132c494f4d281b">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="bcd1daf8f284e6f6f4d1c9d5fafaf28dcbcfd3ecccedda8ad7cdcad5cdfdddfddfcf84fbe9d5d9dbe4cbf384d9c88af6f7c9d9c5c9d08bf88ad9feced0deccf7c8f8">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="9feff8aacfc8cca9feeff1f8e9d7edd9f0c5abf8cfebf8a7d5f0acc8f7c8ebc5cfcce9ada9ceecead5f3ccabfef4abd2d5d9cffde9d4a7c8f8f1cedededecea7dede">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="0746464f643449684b5f4d7d5e5646464656457d6632626c52544a31284f4c49497f617457747e6950315f4951656b4f63507250406341634f522c7f68327e2c4a76">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="15457d7e5a765d505e267226584f206d442220564657705b4578713e7c635c54406722766f627b425022725f533a25642773612661747d653e612c635a4322776341">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="91c0d5f7a7f0f7ffc2dee6d7c3c6c7f9fec4d2a1ded8e5d9c7c0a4d5e1f9ddbac0e4c4e2c3e5e0bea0f0a8a8d5e4f9f9dffee0dea6c3dbf4dfe7f6c6e6f9ffc1d8a8">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="49053c1d13663e2d030e310b3a10792d782b1a667a223d0f3d19192d2b18070b1e2a180e711a213e2d03237a11047c2c0222331c073b2324780a2f1a207d2f301f1e">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="d28ae7e1b5aae4f9b699aaa5beb5e5a09be395a788e3e6bba1e18897b0e4bd81b9f9f982e69fa081a1a3b79bba99bb97e2839e9ca2e4b98abbeaa3a5b68b8aebe184">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>rI+pD9mv7qLU3h22JvQUKnuWNvdJJuQATZ <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="671214021509060a02270f08141309060a02">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
</code></pre>

<p>Tips:</p>

<pre><code>a) 这阻断了系统范围公钥和证书的使用
b) 公钥更为理想化，因为它们更小，除了会阻断证书认证还会阻断公钥
c) 这里证书同样能工作良好，但是如果它在authorized_keys文件中它不会阻断公钥
</code></pre>

<p><br></p>

<pre><code>Jul 19 00:27:26 localhost sshd[11546]: error: WARNING: authentication attempt with a revoked RSA-CERT key 6d:59:82:70:2b:93:dc:57:a6:c6:1f:64:de:ad:be:ef
</code></pre>

<h4>2. 撤销服务器密钥</h4>

<p>服务器密钥得从用户的已知主机文件中撤销，或者在<code>/etc/ssh/known_hosts</code>使用：</p>

<pre><code>#!bash
@revoked * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDc9wlKYUzWZcfvPOa0L+h6Wbb/k9yJgXbnqa3VF+ucdwmBSiT3zBMAjqjFMnN3MuI4oig3SqkIXKPWn0QgFoV4d3G4opzs/OdZ6WLyxLwYQBggUQDg4QhKuHDltIR/BMxYlhB20ngmkaiBiK+Q4ThFRpW7FElOsuZ3rgJq559PgkFeFMY06oyzUMaSshFM84U/1zrVL4BgdnZBcJn018psem5kSkd0Gxm+ao1TuEnMGeArVMFiG9Hq1o2E+QGp1euE4YYQtR533fyZ8BSTE9ThLkmTXgU31dn1irFatBrBENm7TnIVmNT410NqV5J9zDME4NAnuEVwNWtq65rZkgut <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="4f3d20203b0f23202c2e2327203c3b">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
</code></pre>

<p>Tips：</p>

<pre><code>a) 通配符会阻止主机密钥被任何主机使用 
b) 上面的情况中，公钥和证书都能工作，不过公钥更小且更有效 
c) 当和个别已知主机入口一起工作时，简单地删除一个入口并不会阻止密钥被再次使用 
</code></pre>

<p>示例：</p>

<pre><code>#!bash
~ $ ssh example.host.net
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: REVOKED HOST KEY DETECTED!               @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for example.host.net is marked as revoked.
This could mean that a stolen key is being used to impersonate this host.
RSA host key for example.host.net was revoked and you have requested strict checking.
Host key verification failed.
</code></pre>

<h3>证书控制</h3>

<p>签名一个证书时，管理员可以直接实行证书控制，在没有重签名的情况下证书不能被改变</p>

<h4>1. 证书过期</h4>

<p>大多数组织使用密码过期策略，许多情况下需求密码和证书过期，遗憾的是目前仅有特设方法执行ssh密钥轮换。</p>

<p>使用证书，一个过期日期在签名时会加载到证书中，可以使用ssh时间格式-V选项完成</p>

<pre><code>#!bash
~/ssh_cert_authority/user_ca/user_certs $ # Expiration in 52 weeks
~/ssh_cert_authority/user_ca/user_certs $ ssh-keygen -s ../user_ca -I user_full_name -n root,loginname -V +52w username.pub

~/ssh_cert_authority/user_ca/user_certs $ # Expiration in 180 days
~/ssh_cert_authority/user_ca/user_certs $ ssh-keygen -s ../user_ca -I user_full_name -n root,loginname -V +180d username.pub
</code></pre>

<h4>2. 登录名</h4>

<p>正如签名提到的，可以使用-n选项强制使用证书中的登录名和服务器名</p>

<p>对用户来说，这限制了用户在远程服务器上指定的登录名，一般来说，这应该是一个单用户名，但是在一些环境中可能需要多个用户名</p>

<p>下面的例子允许单个证书上的多个登录名：</p>

<pre><code>#!bash
~/ssh_cert_authority/user_ca/user_certs $ ssh-keygen -s ../user_ca -I user_full_name -n loginname,anothername,thirdname username.pub
</code></pre>

<h4>3. 选项(仅限用户证书)</h4>

<p>对于用户证书</p>

<p>对用户证书而言，签名时可以直接构建好几个选项到证书中。一般来说，这些选项运用于/etc/sshd_config或经授权的密钥文件中，这些选项是：</p>

<pre><code>a) clear：假设没有默认选项 
b) force-command=(command)：强制远程命令执行 
c) 默认许可的：代理转发/无代理转发 
d) 默认许可的：端口转发/无端口转发 
e) 默认许可的：pty/无pty 
f) 默认许可的：permit-user-rc/no-user-rc 
g) 默认许可的：x11转发/无x11转发 
h) 源地址=(地址列表)：限制源地址，这些地址中的证书为有效 
</code></pre>

<p>示例：</p>

<pre><code>#!bash
~/ssh_cert_authority/user_ca/user_certs $ ssh-keygen -s ../user_ca -I user_full_name -n login \
  -O clear \ # Clear all default options, including forwarding of all kinds
  -O force-command=/some/specific/command \ # force execution of a specific command
  -O source-address=10.22.72.0/24 \ # limit logins from specific source addresses
  username.pub
</code></pre>

<p>上面的例子限制了只能在特定的服务器上自动化批处理，不允许pty，转发，并强制特定的命令</p>

<h2>0x06 已知的问题</h2>

<hr />

<h3>证书版本问题</h3>

<p>随着OpenSSH6.x的发布，证书的更新导致和OpenSSH 5.x之间存在兼容性问题</p>

<p>OpenSSH6.x生成的证书在OpenSSH 5.x上需要使用选项”-t v00”才能运行，例如：</p>

<pre><code>#!bash
$ ssh-keygen -t v00 -s ca_key -I key_id host_key.pub
</code></pre>

<p>OpenSSH 6.x似乎向后兼容OpenSSH 5.x生成的证书</p>

<h3>SSH客户端兼容性</h3>

<p>除了OpenSSH，如果有的话，仅有少数客户端支持基于认证的证书</p>

<p>尽管大多数常见或不常见的操作系统都运行OpenSSH，也还是有使用其他客户端的。举例来说，Windows上非常流行的Putty，它至今都不支持证书认证。许多使用ssh的商业应用不支持证书认证，例如Rapid7的Nexpose</p>

<p>因此，如果可以的话，有些环境可能会比较难以强制实行只基于认证的证书</p>

<h3>CA密钥安全</h3>

<p>集中化的密钥管理简化了认证管理流程，不幸的是这同时也简化了攻击面，攻击者只许获得CA密钥的管理就能获得对全网的访问</p>

<p>因此，CA密钥的管理必须处于高安全等级，如果可能的话，将它们存储在网络无法访问的地方，并千万千万确保它们被加密了</p>

<h2>0x07 参考资料</h2>

<hr />

<p>本文根据收集来的OpenSSH手册信息进行组织，它们可能会更详尽而且内容以后也会比本文更新</p>

<p><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&amp;sektion=5">sshd_config – OpenSSH SSH daemon configuration file</a></p>

<p><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd – OpenSSH SSH daemon</a></p>

<p><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&amp;sektion=1">ssh-keygen – authentication key generation, management and conversion</a></p>

<p>原文：<a href="http://neocri.me/documentation/using-ssh-certificate-authentication/">Using OpenSSH Certificate Authentication</a></p>      </p>
    
			</body>
		</html>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          